Bug 15991

Summary: Error after calling proc by pointer: `malloc.c:3096: sYSMALLOc'...
Product: glibc Reporter: Alex <a.i.prutkov>
Component: mallocAssignee: Not yet assigned to anyone <unassigned>
Status: RESOLVED INVALID    
Severity: normal CC: neleai
Priority: P2 Flags: fweimer: security-
Version: 2.18   
Target Milestone: ---   
Host: Target:
Build: Last reconfirmed:

Description Alex 2013-10-01 21:57:25 UTC
Dears sirs.

I have a problem when I am trying to run my programm written on C++ (platform is Core i5-2.41 GNU/Linux x86_64).

The programm has many pointers on procedures (about 220), extracted by dlsym from dynamical libraries (such as lissl, as libcrypto, as limcrypt). I need it to protect the programm from Reverse Engineering (LD_PRELOAD etc).

The programm is multithread (Posix Threads), and it has callbacks with local defined objects of different classes (NOT DYNAMICALLY for correct free memory (by their destructors) used by objects in threads) similar:

[CODE=CPP]
void* my1_cb(void *arg){
 Crypt::Rsa rsa; // Rsa is big class for job with openssl rsa keys/CA
 Internet::SSLTcpClent client; // SSLTcpClent is big class for connect to SSL hosts
 
 // etc ...
}
[/CODE]


In the runtime I get error:

[STDOUTPUT]
server: malloc.c:3096: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.
Abort termination
[/STDOUTPUT]

after calling procedure by pointer (from libz.so):

[CODE=CPP]
if (procs->deflateInit2_p(&stream,
Z_BEST_COMPRESSION,
Z_DEFLATED,
m,
8,
Z_DEFAULT_STRATEGY,
procs->zlibVersion_p(),
sizeof(z_stream)) != Z_OK) {
 goto err;
}
[/CODE]

I will be glad any help/tips.

--
Have a nice day.
Comment 1 Ondrej Bilka 2013-10-13 12:24:13 UTC
This is probably application issue, If you run that program in valgrind it will probably find invalid write that caused this.
Comment 2 Ondrej Bilka 2013-10-30 18:44:36 UTC
Closing as this is application issue.